classic.ISPforum.cz

Zdravim, mozte mi poradit s konfiguraciou firewallu? Potreboval by som vediet, ako zakazem vsetky IP a fungovat budu len tie, ktore pridam do firewallu?

coolfire píše:Zdravim, mozte mi poradit s konfiguraciou firewallu? Potreboval by som vediet, ako zakazem vsetky IP a fungovat budu len tie, ktore pridam do firewallu?

Mno..zadej do FW IP, ktere budou mit pristup napr:


a potom vse dropuj napr:



drop pravidlo musi bejt az na konci!!
btw, koukni po foru...takovejch toppicu je tu x..

sub_zero píše:

coolfire píše:Zdravim, mozte mi poradit s konfiguraciou firewallu? Potreboval by som vediet, ako zakazem vsetky IP a fungovat budu len tie, ktore pridam do firewallu?

Mno..zadej do FW IP, ktere budou mit pristup napr:

Kód: Vybrat vše

chain=forward in-interface=bridge1 src-address=192.168.2.8
     src-mac-address=00:11:D8:AD:BB:F9 action=accept

a potom vse dropuj napr:

Kód: Vybrat vše

chain=forward in-interface=bridge1 action=drop

drop pravidlo musi bejt az na konci!!
btw, koukni po foru...takovejch toppicu je tu x..

No to je pekne ale ked ma niekto hw ap ? Mam na mysli to, aku mac tam dat, ap-cka alebo klienta na ethernete?? Skusal som to ale na nic som neprisiel

Gastan píše:

sub_zero píše:

coolfire píše:Zdravim, mozte mi poradit s konfiguraciou firewallu? Potreboval by som vediet, ako zakazem vsetky IP a fungovat budu len tie, ktore pridam do firewallu?

Mno..zadej do FW IP, ktere budou mit pristup napr:

Kód: Vybrat vše

chain=forward in-interface=bridge1 src-address=192.168.2.8
     src-mac-address=00:11:D8:AD:BB:F9 action=accept

a potom vse dropuj napr:

Kód: Vybrat vše

chain=forward in-interface=bridge1 action=drop

drop pravidlo musi bejt az na konci!!
btw, koukni po foru...takovejch toppicu je tu x..

No to je pekne ale ked ma niekto hw ap ? Mam na mysli to, aku mac tam dat, ap-cka alebo klienta na ethernete?? Skusal som to ale na nic som neprisiel

Jakou MAC adresu k IP? ... Zjisti si to v ARP tabulce

presne. Ja osobne pokud pouziju HW klienta, tak mam v ARP IP adresu toho HW Klienta a IP adresu stroje pripojeneho za nim. Obe IP maj stejnou MAC (toho hw klienta). A potom ve FW povolim IP toho stroje(stroju) za tim HW klientem, a dam ji(jim) MAC toho HW klienta........
Druha vec je, pokud mas klienta, kterej nemaskuje stroje za nim za svoji MAC (tusim, ze to umej 100% jen nejaky Dlinky), tak se Ti do ARP dostane i MAC to stroje. A to je potom jeste jednodussi..
..doufam, ze jsem to nenapsal moc slozite...

A ste si isty ze to tak funguje? Lebo ja som si az taky isty neni.
Pokial komunikacia bezi a pridam to tam ako pisete tak to funguje ale ak sa klient vypne a znovu zapne tak je problem, klient za HW AP ziada IP adresu
pre svoju mac a dostane odpoved : prd dostanes nemam tvoju mac.
A este jedna vec, za tym HW mam ja 3 klientov viem si tam predstavit aj 20 a kazdemu zadat tu istu mac toho HW AP sa mi zda divocina

Gastan píše:A ste si isty ze to tak funguje? Lebo ja som si az taky isty neni.
Pokial komunikacia bezi a pridam to tam ako pisete tak to funguje ale ak sa klient vypne a znovu zapne tak je problem, klient za HW AP ziada IP adresu
pre svoju mac a dostane odpoved : prd dostanes nemam tvoju mac.
A este jedna vec, za tym HW mam ja 3 klientov viem si tam predstavit aj 20 a kazdemu zadat tu istu mac toho HW AP sa mi zda divocina

Tak to máš na tom HW AP zapnuté buï klonování MAC adres (stačí vypnout), anebo si to pleteš s DHCP serverem ... aspon tam mi připadalo. Nám to tu takto (s tzv. IP/MAC filterem) na Mikrotiku jede asi 3-4 roky a v pohodě. Věř...

Jo a té divočině (viz.tvuj poslední řádek) - tohle chce IP /MAC filter přímo na tom HW AP - pokud má ... (anebo třeba jako my na Mikrotiku taky). Pokud nemá tak je to divočina jako říkáš ale jinak to nejde.

No nepletiem si to s DHCP, ma to spolocne to ked sa zapne DHCP a astatic-only,staticke lease. No sak ak mozes tak mi to prosimta ukaz
tu je moj firewall,teda kusok

[/quote]/ ip firewall filter
add chain=input connection-state=established action=accept comment="accept \
established connection packets" disabled=no
add chain=input connection-state=related action=accept comment="accept related \
connection packets" disabled=no
add chain=input connection-state=invalid action=drop comment="drop invalid packets" \
disabled=no
add chain=input protocol=tcp psd=21,3s,3,1 action=drop comment="detect and drop port \
scan connections" disabled=no
add chain=input protocol=tcp connection-limit=3,32 src-address-list=black_list \
action=tarpit comment="suppress DoS attack" disabled=no
add chain=input protocol=tcp connection-limit=10,32 action=add-src-to-address-list \
address-list=black_list address-list-timeout=1d comment="detect DoS attack" \
disabled=no
add chain=input dst-address-type=!local action=drop comment="drop all that is not to \
local" disabled=yes
add chain=input src-address-type=!unicast action=drop comment="drop all that is not \
from unicast" disabled=no
add chain=input protocol=icmp action=jump jump-target=ICMP comment="jump to chain \
ICMP" disabled=no
add chain=input action=jump jump-target=services comment="jump to chain services" \
disabled=no
add chain=input action=log log-prefix="input" comment="" disabled=yes
add chain=input action=drop comment="drop everything else" disabled=yes
add chain=ICMP protocol=icmp icmp-options=0:0-255 limit=5,5 action=accept \
comment="0:0 and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=3:3 limit=5,5 action=accept comment="3:3 \
and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=3:4 limit=5,5 action=accept comment="3:4 \
and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=8:0-255 limit=5,5 action=accept \
comment="8:0 and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp icmp-options=11:0-255 limit=5,5 action=accept \
comment="11:0 and limit for 5pac/s" disabled=no
add chain=ICMP protocol=icmp action=drop comment="Drop everything else" disabled=no
add chain=services src-address=127.0.0.1 dst-address=127.0.0.1 action=accept \
comment="accept localhost" disabled=no
add chain=services protocol=tcp dst-port=20-21 action=accept comment="allow ftp" \
disabled=yes
add chain=services protocol=tcp dst-port=22 action=accept comment="allow sftp, ssh" \
disabled=yes
add chain=services protocol=tcp dst-port=23 action=accept comment="allow telnet" \
disabled=no
add chain=services protocol=tcp dst-port=8088 action=accept comment="allow http, \
webbox" disabled=no
add chain=services protocol=tcp dst-port=8291 action=accept comment="Allow winbox" \
disabled=no
add chain=services protocol=udp dst-port=20561 action=accept comment="allow \
MACwinbox " disabled=no
add chain=services protocol=tcp dst-port=2000 action=accept comment="Bandwidth \
server" disabled=yes
add chain=services protocol=udp dst-port=5678 action=accept comment=" MT Discovery \
Protocol" disabled=no
add chain=services protocol=tcp dst-port=53 action=accept comment="allow DNS \
request" disabled=no
add chain=services protocol=udp dst-port=53 action=accept comment="Allow DNS \
request" disabled=no
add chain=services protocol=udp dst-port=1701 action=accept comment="allow L2TP" \
disabled=yes
add chain=services protocol=tcp dst-port=1723 action=accept comment="allow PPTP" \
disabled=yes
add chain=services protocol=gre action=accept comment="allow PPTP and EoIP" \
disabled=yes
add chain=services protocol=ipencap action=accept comment="allow IPIP" disabled=yes
add chain=services protocol=udp dst-port=1900 action=accept comment="UPnP" \
disabled=no
add chain=services protocol=tcp dst-port=2828 action=accept comment="UPnP" \
disabled=no
add chain=services protocol=udp dst-port=67-68 action=accept comment="allow DHCP" \
disabled=no
add chain=services protocol=tcp dst-port=8080 action=accept comment="allow Web \
Proxy" disabled=yes
add chain=services protocol=tcp dst-port=123 action=accept comment="allow NTP" \
disabled=no
add chain=services protocol=tcp dst-port=161 action=accept comment="allow SNMP" \
disabled=yes
add chain=services protocol=tcp dst-port=443 action=accept comment="allow https for \
Hotspot" disabled=yes
add chain=services protocol=tcp dst-port=1080 action=accept comment="allow Socks for \
Hotspot" disabled=yes
add chain=services protocol=udp dst-port=500 action=accept comment="allow IPSec \
connections" disabled=no
add chain=services protocol=ipsec-esp action=accept comment="allow IPSec" \
disabled=no
add chain=services protocol=ipsec-ah action=accept comment="allow IPSec" disabled=no
add chain=services protocol=tcp dst-port=179 action=accept comment="Allow BGP" \
disabled=yes
add chain=services protocol=udp dst-port=520-521 action=accept comment="allow RIP" \
disabled=yes
add chain=services protocol=ospf action=accept comment="allow OSPF" disabled=yes
add chain=services protocol=udp dst-port=5000-5100 action=accept comment="allow BGP" \
disabled=yes
add chain=services protocol=tcp dst-port=1720 action=accept comment="allow \
Telephony" disabled=yes
add chain=services protocol=udp dst-port=1719 action=accept comment="allow \
Telephony" disabled=yes
add chain=services protocol=vrrp action=accept comment="allow VRRP " disabled=yes
add chain=virus protocol=tcp dst-port=135-139 action=drop comment="Drop Blaster \
Worm" disabled=no
add chain=virus protocol=udp dst-port=135-139 action=drop comment="Drop Messenger \
Worm" disabled=no
add chain=virus protocol=tcp dst-port=445 action=drop comment="Drop Blaster Worm" \
disabled=no
add chain=virus protocol=udp dst-port=445 action=drop comment="Drop Blaster Worm" \
disabled=no
add chain=virus protocol=tcp dst-port=593 action=drop comment="________" disabled=no
add chain=virus protocol=tcp dst-port=1024-1030 action=drop comment="________" \
disabled=no
add chain=virus protocol=tcp dst-port=1080 action=drop comment="Drop MyDoom" \
disabled=no
add chain=virus protocol=tcp dst-port=1214 action=drop comment="________" \
disabled=no
add chain=virus protocol=tcp dst-port=1363 action=drop comment="ndm requester" \
disabled=no
add chain=virus protocol=tcp dst-port=1364 action=drop comment="ndm server" \
disabled=no
add chain=virus protocol=tcp dst-port=1368 action=drop comment="screen cast" \
disabled=no
add chain=virus protocol=tcp dst-port=1373 action=drop comment="hromgrafx" \
disabled=no
add chain=virus protocol=tcp dst-port=1377 action=drop comment="cichlid" disabled=no
add chain=virus protocol=tcp dst-port=1433-1434 action=drop comment="Worm" \
disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Bagle Virus" \
disabled=no
add chain=virus protocol=tcp dst-port=2283 action=drop comment="Drop Dumaru.Y" \
disabled=no
add chain=virus protocol=tcp dst-port=2535 action=drop comment="Drop Beagle" \
disabled=no
add chain=virus protocol=tcp dst-port=2745 action=drop comment="Drop Beagle.C-K" \
disabled=no
add chain=virus protocol=tcp dst-port=3127-3128 action=drop comment="Drop MyDoom" \
disabled=no
add chain=virus protocol=tcp dst-port=3410 action=drop comment="Drop Backdoor \
OptixPro" disabled=no
add chain=virus protocol=tcp dst-port=4444 action=drop comment="Worm" disabled=no
add chain=virus protocol=udp dst-port=4444 action=drop comment="Worm" disabled=no
add chain=virus protocol=tcp dst-port=5554 action=drop comment="Drop Sasser" \
disabled=no
add chain=virus protocol=tcp dst-port=8866 action=drop comment="Drop Beagle.B" \
disabled=no
add chain=virus protocol=tcp dst-port=9898 action=drop comment="Drop Dabber.A-B" \
disabled=no
add chain=virus protocol=tcp dst-port=10000 action=drop comment="Drop Dumaru.Y" \
disabled=no
add chain=virus protocol=tcp dst-port=10080 action=drop comment="Drop MyDoom.B" \
disabled=no
add chain=virus protocol=tcp dst-port=12345 action=drop comment="Drop NetBus" \
disabled=no
add chain=virus protocol=tcp dst-port=17300 action=drop comment="Drop Kuang2" \
disabled=no
add chain=virus protocol=tcp dst-port=27374 action=drop comment="Drop SubSeven" \
disabled=no
add chain=virus protocol=tcp dst-port=65506 action=drop comment="Drop PhatBot, \
Gaobot" disabled=no
add chain=forward connection-state=established action=accept comment="accept \
established packets" disabled=no
add chain=forward connection-state=related action=accept comment="accept related \
packets" disabled=no
add chain=forward connection-state=invalid action=drop comment="drop invalid \
packets" disabled=no
add chain=forward src-address-type=!unicast action=drop comment="drop all that is \
not from unicast" disabled=yes
add chain=forward protocol=icmp action=jump jump-target=ICMP comment="jump to chain \
ICMP" disabled=no
add chain=forward action=jump jump-target=virus comment="jump to virus chain" \
disabled=no
add chain=forward in-interface=ether1 src-address=192.168.100.244 \
src-mac-address=00:15:F2:AC:12:7D action=accept comment="IP Mac pristup" \
disabled=no
add chain=forward in-interface=ether1 src-address=192.168.100.245 \
src-mac-address=00:11:D8:8D:C1:46 action=accept comment="" disabled=no
add chain=forward in-interface=ether1 src-address=192.168.100.246 \
src-mac-address=00:11:5B:1E:F2:06 action=accept comment="" disabled=no
add chain=forward src-address=192.168.100.247 src-mac-address=00:4F:62:03:77:AD \
action=accept comment="" disabled=no
add chain=forward src-address=192.168.100.249 action=accept comment="" disabled=no
add chain=forward src-address=192.168.100.251 src-mac-address=00:04:E2:80:9E:7C \
action=accept comment="" disabled=no
add chain=forward src-address=192.168.100.0/24 action=add-src-to-address-list \
address-list=blacklist address-list-timeout=1d comment="block all" disabled=no
add chain=forward src-address-list=blacklist action=drop comment="" disabled=no
add chain=forward action=accept comment="Accept everything else" disabled=no
add chain=output connection-state=invalid action=drop comment="drop invalid packets" \
disabled=no
add chain=output connection-state=related action=accept comment="accept related \
packets" disabled=no
add chain=output connection-state=established action=accept comment="accept \
establised packets" disabled=no
add chain=output connection-state=established action=accept comment="accept established packets" disabled=no[quote][/quote]

lol trochu som to posral s tym [quote][/quote]

Tak ted jsem si hral se dvema krabickama (HW AP) a vysledek takovy:

Dlink DWL 200AP+. Pokud mam na nem vyple klonovani MAC, tak v ARP Mikrotiku klient za nim vystupuje pod MAC toho Dlinku. Vse se connectne i pres DHCP. Otazka je, jak by se to chovalo, kdyby za tim Dlinkem byl switch a treba dalsi stroj. Nejsem si jistej, jestli to jde v Mikrotiku zadat pod jednu MAC treba vic IP (ale asi ne ) Pokud na tom Dlinku zapnu klonovani MAC, tak v ARP se sice objevi MAC toho stroje za nim, ve FW povolim jeho MAC, klient se pripoji, ale v logu mi to zacne psat tohle



MAC je toho Dlinku. Klient se pritom v poho pripoji a chodi. Podotykam, ze na wlanu mam vyplou Default Authentizaci a klienty mam nakopceny v Access listu. A v nem byla i ta MAC toho Dlinku.

Toto moje troska do mlyna... pls, nekamenujte mne..